December 2003 - cypherpunks-legacy

Re: Encryption and the 2nd Amendment
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:39 PM 1/20/96, Michael Froomkin wrote: >IMHO the 2nd amendment argument is bunk. [I haven't seen the Wired >article BTW, so this is just a general point.] I haven't seen the "Wired" article either, as I no longer read it. I agree with Michael that an association of crypto with arms is a long reach, unsupported in anything I've seen in the Constitution or related papers. Moreover, any successful link made could be disastrous. After all, it is well-established--whether we like it or not--that the government can regulate and control access to hydrogen bombs, bazookas, nerve gases, grenades, fully-automatic weapons, and even various kinds of rifles and handguns. I would hate to see crypto truly classified as an armament (beyond what the ITARs say) and thus be subject to the same kinds of regulations as above. Be careful what you wish for, you might get it. A much stronger claim can be made, I think, that crypto is a form of language or speech, clearly protected by the First Amendment. Thus, writing one's diary in an encrypted form (a common practice in colonial days, interestingly) is a form of language one uses. Thus, "Congress shall make no law..." about this speech or writing. That two people choose to converse in ROT-13 or in RSA or in their own private code is not something the government is authorized to interfere with. Ikewiselay, itingwray inlay igpay atinlay islay otectedpray. --Imtay Aymay Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: Wipe Swap File
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:38 PM 1/20/96, Dr. Dimitri Vulis wrote: >tallpaul(a)pipeline.com (tallpaul) writes: >> Remember that one simple wipe is *not* secure. Current Department of >> Defense security regs call for wiping the same space something like 8 or 9 >> times. Even then the wipe is not secure enough for higher level DofD >> classified material. There the regs call for the physical destruction of >> the medium after it has been wiped. > >Degaussing the media (running a household magnet over it :-) may be an option. Ordinary household magnets fail for a couple of reasons: 1. Their field strength is not high enough to affect modern media, due to the extremely high coercivity of modern media. (Try it out, you'll be surprised at hard it is to really change a lot of bits with a household magnet.) 2. Most "swap files," as used above, are of course on hard drives. Encased in metal. In any case, the nearest a household magnet can get to the surface is several centimeters. Unless the magnet is very large (such as the 20-pounder I have from my childhood days), the field strength will drop drastically in several centimeters. (Modern disk drives, and even modern videotape machines, use very high-coercivity coatings, including pure metal, and the heads must ride very close to the media to flip the domains. A magnet several centimeters away is effectively at infinity.) 3. A time-varying field is preferred. Bulk erasers work this way, by plugging into an a.c. socket and generating a time-varying field. And even these are getting harder to use to erase video tapes, for example, due to the high coercivity of modern media. Most folks I know no longer even try to bulk erase tapes. >1. Does anyone know a cheap way to recover the traces of the previous >(overwritten) recordings on the media? There are custom drives for various media which have multiple heads, and heads that can be "jogged" a little bit. This allows, I have read, the subtle variations of multiple writes to be extracted. Much more expensive would be various electron microscope-based imaging methods to directly image the domains and extract subtle signs of past write cycles. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: A weakness in PGP signatures, and a suggested solution
by Brian C. Lane 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > > In article <Pine.ULT.3.91.960110182255.18692H-100000@xdm011>, Jeffrey Goldberg <cc047(a)Cranfield.ac.uk> says: > > But then the recipient has a PGP-signed message from you which > isn't encrypted (using pgp -d). That person could then impersonate > you. Eg Alice the jilted lover could resend the goodbye message > with forged headers to Bob's new girlfriend to get back at him. Ah ha! Now I understand what this argument has been all about. This is not a flaw with PGP, but with the software doing the signing. It should/could add a line with a time and date stamp inside the signature envelope, or Bob could add more information, making the message more specific. I don't think PGP needs to be 'fixed', but the signing software does. Brian -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMP0gGHIWObr6ZnuNAQFqpQMAhEDxcClXzwqS5QLSYgbGC0SdPwOSppgG cbEcHEamA+C/fzlCRl1FoCkvA/SPHoZB29FNJSH8hnP6s5OZQfFf3LZXPL+/UFiL 64i7dlt6Ajtg58eDiMj/+qPsHd8hbAuV =jj8n -----END PGP SIGNATURE----- --- <blane(a)eskimo.com> -------------------- <http://www.eskimo.com/~blane> --- Embedded System Programmer, EET Student, Interactive Fiction author (RSN!) ============== 11 99 3D DB 63 4D 0B 22 15 DC 5A 12 71 DE EE 36 ============

4 4

Re: Espionage-enabled Lotus notes.
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:38 AM 1/18/96 -0500, hallam(a)w3.org wrote: >The problem with this system is that it is quite likely to suceed. Unlike >Clipper which made unfettered access to encrypted material possible the escrowed >key strength reduction means that the FBI can tap a significant number of >locations, just not all of them. 40-unknown-bit RC4 may take a week for an ICE workstation or a herd of net-coordinated workstations, but it would be much faster to crack on a specialized machine actually designed for RC4. I think Eric's estimate was $25-50K for a machine that could do it in 15 minutes, built out of programmable gate arrays. That's not $10,000/crack, or $584, but $0.25-.50. Would they crack all the keys they wanted for a quarter each? Sure; at that rate it's probably cheaper to crack them than read them (though in reality they'd feed most of them to keyword scanners.) >It will be very hard to argue effectively against this idea in Congress. >Much harder than the Clipper chip which was dead on arrival. You may be right. They keep making outrageous demands, and "compromising" on less outrageous ones. Something prominently not mentioned in the article was "escrow agents" for the 24 bits of wiretap-support key; apparently foreigners don't get even that much due process. Nor was there a clarification of whether all the software has the same wiretap key (probable) or each copy has a different wiretap key (the Clipper model.) If it's just one key, then nobody's mail is safe. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

1 0

Re: Win95 Registration Wizard info
by JR＠ns.cnb.uam.es 17 Dec '03

17 Dec '03

From: SMTP%"alano(a)teleport.com" 18-JAN-1996 23:29:11.16 >At 10:03 AM 1/18/96 -0500, Perry E. Metzger wrote: >> >>Alan Olsen writes: >>> I picked this link up from the Fringewear list. >>[...] >>> The author takes the registration Wizard in Win95 apart and shows exactly >>> what it does and what it looks for. Some interesting information about the >>> encrypted database of product information it uses. >> >>What, exactly, does this have to do with cypherpunks? > >I posted it for two reasons. > ... reason one deleted ... >2) The program's use of encryption to conceal what products it looks for. > ... rest of message deleted ... I also found interesting the use of a debugger to break Microsoft's crypto. When we speak about crypto, we do not only refer to algorithms, we must also consider insiders, eavesdroppers, etc... Well, this is a good example of a technique to break encrypted messages that has proven useful and, what's more, has the support of the operating system. A big mistake from Microsoft. And also in many other vendors. While not interesting in many protocols, it is worthy in those where one of the parts doesn't trust the other. The point is that any non-trusted party can try a similar approach -using a debugger- to gather information from within their computer (passwords, keys, data...) unless there is some way to prevent it (like using a better approach or protocol). It's silly to send text in the clear through an insecure channel. So it is to store passwords in the clear in world-readable files. Or to keep data in memory which can be paged to disk... The article comes to point out that it is also as silly to store cleartext in any program memory that can be accessed/traced/dissected by an untrusted user. And that Microsoft obviously choose again a too weak (mean?) approach to secure their data. I wonder now wether one could still rely on Microsoft to provide a reasonable Crypto API as they are bragging lately... jr

1 0

Re: Respect for privacy != Re: exposure=deterence?
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 9:03 PM 01/19/96, Rich Graves wrote: >I'll certainly grant you that there is a conspiracy and a secret >government (broadly defined), but not everyone paid by the government is >in on it, and not everyone involved is in the government. Nah, many conspiracies. Lots of government folks doing their own secret, non-secret, and semi-secret stuff in cooperation with other government folks and non-government folks. Adam Smith either said, or is frequently misquoted as saying, that whenever two business people of the same profession meet, it's a conspiracy. That goes double for two government agents. [What's a double conspiracy? You'd know if you were in on it.] >Gratuitous use of pseudonymity can be counterproductive. Now nobody's >going to be able to use your "bar-coded garbage" essay without being >suspected of being you, which I doubt is what you want. > >Is anyone going to quote you in the future, as you quote Patrick Henry? Or as everyone quotes Publius? Who is Publius anyway? Alexander Hamilton or Tom Jefferson, or someone like that, I forget. Would they quote Publius if they never figured out who "really" wrote Publius' stuff? I dunno. Maybe eventually we'll know who We Jurgar Din "really" is. But probably not, becuase we won't even remember what he wrote, let alone be interested in who he "really" is. And I guess everyone doesn't quote Publius anyway. But every American Constitutional Law textbook probably does, and most American History textbooks. Maybe future American Bar Code textbooks will quote We Jurgar Din. Somehow I doubt it, though.

1 0

Re: Espionage-enabled Lotus notes.
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:16 PM 1/18/96 -0500, "Richard Martin" <rmartin(a)aw.sgi.com> wrote: >The Lotus `solution' seems to be the action of an American company >shipping a product which effectively says to foreign users, "We don't >care about you as a market." To play Sternlight's Advocate for the moment, I'll have to disagree with you here. 40-bit encryption really is a joke, for any business data worth protecting (and Lotus Notes is primarily a business product.) 64-bit RC4 encryption, while less than ideal, is still usable for most applications; it's certainly stronger than DES by a couple orders of magnitude, which is probably enough for now. Yes, the Yanquis can wiretap you, but it's better than having _everybody_ wiretap you. (And besides, you're probably going to use the 128-bit smuggled version anyway.) This at least provides a product you can use with _some_ credibility, assuming it interoperates with the US version, which I think the 40-bit version did. >That this is the so-called "export" >version is ironic. The keys are escrowed with the U.S. government, >and no one else. The French government should rightly cry foul, for >this is (a) encryption where they don't have the keys and (b) encryption >where another government *does*. The French can still ban it, or require you to register your keys, just as they can with the 40-bit version. Or ban products with menu items in English, if they think that's too encrypted for them. :-) C'est la guerre. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "Eternal vigilance is the price of liberty" used to mean us watching # the government, not the other way around....

1 0

Jan 27 special Bay Area CA mtg
by mrm＠netcom.com 17 Dec '03

17 Dec '03

Out-of-band cypherpunk meeting Saturday Jan 27 12 noon - 3 p.m. Sparcy's cafeteria, B21, Sun Microsystems, Mountain View, California The reason to call a special half-meeting on January 27th is that a producer/videographer for PBS would like to film a discussion among cypherpunks about 1st amendment issues, for a PBS show named "Freedom Speaks." The show airs nationally on PBS. In San Francisco, currently on KMPT Thursdays at 5 p.m., and starting in March, on KQED. The producer is Roger Masterton and he describes his goals like so: (the parts in between [] are my paraphrasing of what he said, for brevity) I am currently working on the story for a program we will tape in 2 weeks about Cryptography, focusing on the Free Speech aspect as well as the governments attempt to limit export of programs. ... The reason that I'm writing to you is that we would like to shoot a cypherpunks meeting as a way of introducing the [program.] [We want to film cypherpunks talking on camera] about the need for cryptograpy and the government's attempt to control access. ... I talked with him on the phone. He is affiliated with a group known as the Freedom Forum in Arlington, VA, which is non-partisan and non-profit. I said, sure, I'd be glad to reserve the room and call for a meeting, but that it would be up to the local Bay Area cypherpunk community as to whether or not folks could make this meeting. I also mentioned that a number of us have had mixed experiences with the media, and that we're pretty cynical about being presented fairly. I told him a several of us have endured the problem of spending all day in some video shoot, only to have 10 seconds of out-of-context inflammatory sound byte show up on the eventual program. If you want to, it would help me to know if you think you can make the meeting on Jan 27th, so we have some idea how long to wait for people to show up before starting the "official" agenda. Marianne mrm(a)eng.sun.com mrm(a)netcom.com p.s. directions to B21 of Sun: Take 101 south to Amphitheater Parkway. Turn left at the light at the bottom of the exit ramp onto Charleston. (This street is also known as Garcia.) After about 1/3 mile, turn right onto the first real side street. In about 2 long city blocks, you'll see big purple and white signs for B21 of Sun. The meeting is held in the cafeteria. This time I'll bring blank foils and pens. :-)

1 0

Re: NSA vacuuming down Internet traffic
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Jan 20, 1996 04:05:50, 'Tatu Ylonen <ylo(a)cs.hut.fi>' wrote: >As for the keyword search problem, it would easily be possible to scan >much of the data (say, tcp ports smtp, nntp, login, exec, ident) in >real time against a million-phrase dictionary (containing keywords, >e-mail addresses, names, abbreviations, etc.). If there are >performance problems, you can first limit by >source/destination/protocol/port. Only intercepts (e.g., entire tcp >connections) that pass this initial screening are passed on to other >machines for more complicated analysis. > >Note also that many parts of the filtering problem parallelize quite >nicely. Or simply pipeline it. Bare bones Pentium systems go for under $US 1,000 (quantity one) on the open market. Buy them in quantity and a private company can set up a thousand Pentium pipeline for under a million dollars. Easily affordable for even medium-sized corporations. -- tallpaul "To understand the probable outcome of the Libertarian vision, see any cyberpunk B movie wherein thousands of diseased, desparate and starving families sit around on ratty old couches on the streets watching television while rich megalomaniacs appropriate their body parts for their personal physical immortality." R. U. Sirius _The Real Cyberpunk Fakebook_

1 0

New China Ruling Threatens Closure Of News Agencies 01/19/96
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

In effect, the edict puts Xinhua, the world's unnewsiest news agency, in charge of agencies normally beyond the grasp of cadre communists -- even in Hong Kong, Macau and, Taiwan. On this basis, the next time Hong Kong billionaire Li Ka-shing did a deal with state authorities that relieved McDonald's Corp. or any other legal entity of its contractual rights (as happened last year), the story would have to be vetted by Xinhua. Xinhua already made information-control history when it established a service that both disseminates outgoing commercial data on the Internet and filters any incoming information. Although the State Council's directive gives Xinhua control over strictly "economic" news, the government body has licensed Xinhua to control everything, effectively ruling out reliable news. Stock markets and business plans are driven by market forces -- even in highly manipulated China. Even when one is tempted to think business is market driven, the whims of China's central controllers can skew everything -- as merchandisers in the casual wear clothing market found when that suddenly dried up because the bosses on top didn't like then Giordano clothing store chairman Jimmy Lai. The State Council's directive will in all likelihood force the New York Times, Reuters and other news organizations to reassess their operations in territories Xinhua is authorized to control. Controls go beyond editorial conventions. According to Xinhua, foreign wire services will not be allowed to increase subscribers in China "directly nor by ways of establishing joint ventures, solely funded companies or agents." The Xinhua report said that foreign news providers "will be punished in accordance with the law if their released information to Chinese users contains anything forbidden by Chinese laws and regulations, or slanders or jeopardizes the national interests of China." Jeopardizing the national interest of China is now taken to mean jeopardizing the interests of the communist party, or the roughly 5% of the population controlling the country from "the barrel of a gun," to borrow from Mao Zedong. Agencies only learned of the new rules Tuesday night when Xinhua, skirting the usual practice of circulating advisories on operational changes internally, simply put the story on the wire. One Hong Kong agency man told Newsbytes: "We always knew writing stories from China was a problem. Now you have to wonder if we'll be able to send stories from Hong Kong, without having to pass them by Xinhua for approval. The directive indicates stories will have to pass through Xinhua first -- pointing to a major evacuation of news services, and technology vendors who handle them. (Nigel Armstrong & I.T. Daily/19960117)

1 0